wmantly
455450db1f
A dedicated spoke.env for the join-a-cluster vars (CFG_MASTER_DIRECTORY_URL/ _JOIN_KEY, CFG_SPOKE_NO_INBOUND/_PUBLIC_HOST, CFG_PUBLIC_DOMAIN), split out of setup.env purely for clarity -- setup.env still has every option and keeps working as a single file if that's preferred. setup.sh reads both (setup.env first, spoke.env layered on top so its values win), same first-run-only rule as setup.env already had. Also adds CFG_PUBLIC_DOMAIN (documented in MULTI_SITE_SPEC.md §4 but never actually wired into setup.sh): an inbound spoke/standalone site's own public web domain, independent of CFG_DOMAIN (the shared LDAP identity namespace, which must stay identical across every site). Unset behaves exactly as before -- hostnames derive from CFG_DOMAIN like any standalone install.
35 lines
1.3 KiB
Plaintext
35 lines
1.3 KiB
Plaintext
# Local deployment config — contains secrets (LDAP admin password, JWT secret,
|
|
# OAuth client secret, LDAP service password, SMTP creds). Never commit.
|
|
# ./config/ holds the live sso-secrets.js + proxy-secrets.js (generated by
|
|
# setup.sh); committed examples live in config.example/.
|
|
config/
|
|
backups/
|
|
|
|
# .env: NOT app config (that's ./config/, generated by setup.sh) — this is
|
|
# docker compose's own auto-loaded env file, which setup.sh uses only to
|
|
# persist *_GIT_COMMIT build args so an ad-hoc rebuild of a single service
|
|
# still bakes the right commit hash. Generated; never commit.
|
|
# proxy.env: legacy, no longer used — still ignored in case an old
|
|
# deployment hasn't deleted it yet.
|
|
.env
|
|
proxy.env
|
|
|
|
# setup.env — operator's first-run domain config (copied from setup.env.example,
|
|
# which IS committed). Holds the domain as a base DN; setup.env itself is
|
|
# per-deployment and is not committed.
|
|
setup.env
|
|
|
|
# spoke.env — same rule as setup.env, but for the join-a-cluster vars split
|
|
# out for clarity (spoke.env.example IS committed). Holds a real site join
|
|
# key once filled in.
|
|
spoke.env
|
|
|
|
# Backup artifacts (hold secrets — the whole user directory + Redis dumps)
|
|
*.rdb
|
|
*.ldif
|
|
|
|
# Docker Compose runtime artifacts
|
|
*.log
|
|
|
|
# Jekyll build output (docs/ site) — generated, not committed.
|
|
docs/_site |